Re: Regression Bug: use-after-free Write in udf_close_lvid

[Jan Kara]

Hello!

On Thu 26-12-24 13:42:31, Kun Hu wrote:
> When using fuzzer tool to fuzz the latest Linux kernel, the following crash
> was triggered.
> 
> HEAD commit: 78d4f34e2115b517bcbfe7ec0d018bbbb6f9b0b8
> git tree: upstream
> Console output: https://drive.google.com/file/d/1z_7XDn7042k9LzqJgxa8Sj0WqRfmfkdQ/view?usp=sharing
> Kernel config: https://drive.google.com/file/d/1RhT5dFTs6Vx1U71PbpenN7TPtnPoa3NI/view?usp=sharing
> C reproducer: https://drive.google.com/file/d/1hbgE6cac58A7YK7N75JIB-1tZo0G20Cl/view?usp=drive_link
> Syzlang reproducer: https://drive.google.com/file/d/1hbgE6cac58A7YK7N75JIB-1tZo0G20Cl/view?usp=sharing

The syzlang reproducer seems to be missing (the link points to C code). As
a result one has to decipher what's actually happening from the C code
which is a bit tedious... Please fix that.

> Similar Bug: https://lkml.org/lkml/2022/5/24/336

I have checked your reproducer and as far as I can tell it will modify
block device under a mounted filesystem (trying to use the same loop device
for xfs and udf). Such action is effectively equivalent to corrupting
memory. Please make sure CONFIG_BLK_DEV_WRITE_MOUNTED is disabled in all
your kernel configs used for fuzzing to avoid these invalid reproducers.
Thanks!

								Honza
-- 
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR